test(datastore): enumeration integration suite part 3/4 (S09 Enforcement plan: 18/20)

Part 3 of 4 of the S09 enforcement plan — Step 18: Candidate repository enumeration.

The step is split into 4 stacked MRs to keep each within the review size limit (≈800 ideal). Each part targets the previous one (part 1 → main); review and merge bottom-up.

Stacked MRs (review/merge bottom-up)

• feat(datastore): List guard extraction, zero cu... (!2143 - merged) • David Fernandez • 19.4
• feat(datastore): repository key enumeration par... (!2144 - merged) • David Fernandez • 19.4
• test(datastore): enumeration integration suite ... (!2145 - merged) • David Fernandez • 19.4 👈
• feat(datastore): fetch rows by id set with a ba... (!2146 - merged) • David Fernandez • 19.4

This part (~879 reviewable LoC, test-only)

The integration suite for part 2's EnumerateRepositoryKeys: every sort column in both directions, keyset page walks with tied counters, the COALESCE(last_updated_at, created_at) key across page boundaries, format/kind filters, tenant scoping, parity with List's candidate order, the exact hasMore boundary, the error-wrap contract, and the EXPLAIN gates (index-only scans for the counter sorts; sort-free index scans for name and the coalesced timestamp, which PostgreSQL cannot serve index-only from an expression index). Also carries the //nolint:dupl pair edits on the two List tests these mirror closely enough for dupl to fire. The filter tables deliberately diverge: this suite covers every repository kind as a positive hit, which took that pair below dupl's threshold.

Size and split notes: over the 500-LoC review target because it is a single method's test suite mirroring the List suite's structure — splitting it further would split one function's coverage across MRs. Shipping the suite separately from part 2's production code is a deliberate tests-with-code waiver to keep every part inside review size limits; part 2 carries the unit tests, and this part must merge before the stack is complete.

References

• Plan: docs/plans/2026-08-21-s09-authorization-enforcement.md
• Spec: S09 (authorization)

Related to #860 (closed)